California’s Consumer Privacy Act of 2018 – Get Ready for New GDPR Style Requirements in the US

At the end of June, the California legislature passed its Bill 375, the California Consumer Privacy Act of 2018. The Act contains a number of concepts that would be familiar to those who are working to bring their companies and organizations into compliance with GDPR. The new law defines a category of “Personal Information” that radically departs from a traditional definition of Personal Data commonly found in various State Data Privacy Laws, which usually ties an individual name to other identifiers like social security number, account number, or other factors. Instead, the California Act defines “Personal Information” as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not, mercifully, include publicly available information, but it still comes closer to a GDPR-like definition of “personal data” than any other US law.

The Act provides California residents some rights that also appear familiar. For example:

Consumers can request a copy of all the Personal Information a business has collected;

Consumers have the right to request that the business delete their Personal Information (subject to some exceptions), and a right to direct a company to not share their Personal Information with third parties; and

Consumers can request that a business disclose the categories of information it has collected, the sources of information, the purpose for the collection and/or its sale of the information, and the third parties with whom the information is shared.

These certainly sound like concepts that could be referenced as The Right to Access; The Right to Be Forgotten; and Data Portability.

Business requirements include:

Meaningful notifications to consumers at the point of contact where Personal Information is collected;

Updated online privacy notices to include the types of Personal Information collected, the purpose of collection, and rights information;

The inclusion of provisions in contracts with third parties with whom Personal Information is shared to include data privacy protections and restrictions on disclosure; and

The inclusion of a “do not sell my personal information” option on public facing interfaces and websites that collect personal information. Companies must take measures to not discriminate against users who opt out, but at the same time they can offer price incentives to those who chose to opt in.

The Act takes effect on January 1, 2020. It has the same approximate 2 year “runway” period that GDPR provided in 2016 (leading up to May 25, 2018) for companies to gear up their compliance. This law has potentially widespread impact, but some of the mechanisms of its application remain unclear, due in some degree to some of its broadly worded language. In this way, it is also similar to the GDPR.

The challenge with implementation for large companies is the same as every other State level data privacy law – it is often virtually impossible to reliably identify who the “California” consumers are. Thereby making it by practical necessity a global requirement for all publicly facing systems and applications for all users.

We recommend that most companies prioritize and stage their compliance today, focusing on GDPR in the short term, but a California (or potentially necessary practical nationwide) compliance strategy should be included in late 2018 and 2019 IT and Privacy compliance plans.

About Seyfarth's eDiscovery and Information Governance Team

Seyfarth Shaw’s eDiscovery and Information Governance (eDIG) attorneys dedicate 100% of their practices to eDiscovery and information governance issues, advising and litigating on these complex matters efficiently, effectively and creatively. Seyfarth is one of the few law firms with a truly dedicated eDiscovery practice group — one that began well before the Federal Rules of Civil Procedure were amended in 2006. We bring experience and talent to craft practical and defensible approaches to meet discovery obligations in litigation to comply with statutory and regulatory rules while managing the costs and the realities of operating a business in today’s economy. We have worked with some of the country’s largest companies on eDiscovery issues in specific major litigation as well as broader strategic approaches to eDiscovery.